Senior Cyber Defense Incident Responder - On-Call

Ørsted A/S; Warszawa; Hybrid; PLN 150,000 - 210,000; Full time

Job summary

Ørsted A/S in Warsaw, Poland, seeks an experienced cyber security incident responder to lead investigations across global IT and OT environments. You will analyze logs, endpoints, and forensic evidence to determine root cause, scope and impact, coordinating responses with technical teams and stakeholders.

You will also engage in threat hunting, develop forensic capabilities, and continuously improve incident response playbooks while contributing to on‑call rotations outside normal hours.

Qualifications

• Experience in detecting, investigating and responding to cyber security incidents across IT/OT environments.
• Ability to analyze logs, network and endpoint data, and forensic evidence to establish root cause, scope and impact.
• Experience with security monitoring/investigation technologies (SIEM, XDR/EDR) and turning findings into improvements.
• Strong communication of complex technical issues to technical teams and senior stakeholders.

Responsibilities

• Lead and conduct technical investigations of cyber security incidents across global IT and OT environments.
• Analyze logs, network and endpoint data, and forensic evidence to determine root cause and impact.
• Coordinate incident response across technical teams and translate findings into clear recommendations for stakeholders.
• Design and execute intelligence-led threat hunting and forensic investigations.
• Document investigations, lessons learned, and incident timelines to improve response playbooks and procedures.

Skills

Incident response

Threat hunting

Digital forensics

Root cause analysis

Stakeholder communication

IT/OT security knowledge

Tools

SIEM

EDR/XDR

Job description

Ørsted A/S in Warsaw, Poland, seeks an experienced cyber security incident responder to lead investigations across global IT and OT environments. You will analyze logs, endpoints, and forensic evidence to determine root cause, scope and impact, coordinating responses with technical teams and stakeholders.

You will also engage in threat hunting, develop forensic capabilities, and continuously improve incident response playbooks while contributing to on‑call rotations outside normal hours.